CVE-2026-35594 Details
Description
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/models/link_sharing.go) constructs authorization objects entirely from JWT claims without any server-side database validation. When a project owner deletes a link share or downgrades its permissions, all previously issued JWTs continue to grant the original permission level for up to 72 hours (the default service.jwtttl). This vulnerability is fixed in 2.3.0.
A vulnerability in Vikunja's link sharing feature allows deleted or downgraded permissions to remain effective for up to 72 hours. This issue arises because the authorization process relies solely on JWT claims, without verifying against the database. As a result, when a project owner removes a link share or reduces its permissions, previously issued JWTs still provide the original access level for the duration of their validity. This vulnerability affects Vikunja versions prior to 2.3.0.
Users can update to Vikunja version 2.3.0, which includes a fix that validates link share JWTs against the database, ensuring that revoked shares are properly recognized and unauthorized access is prevented.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-96q5-xm3p-7m84 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/go-vikunja/vikunja/commit/379d8a5c19334ffe4846003f590e202c31a75479 | [email protected] | Patch |
| https://github.com/go-vikunja/vikunja/pull/2581 | [email protected] | Issue Tracking |
| https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 | [email protected] | Release Notes |
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-96q5-xm3p-7m84 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vikunja vikunja | < 2.3.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 14, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | New CVE Received | [email protected] |